Microsoft and CrowdStrike shift IT outage recovery burden to Delta

August 7, 2024
1 min read

TLDR:

  • Microsoft pushed responsibility for Delta’s IT outage back to the airline, citing delayed modernization efforts.
  • CrowdStrike also joined in criticizing Delta’s legal posturing after a disruptive IT outage.

In a recent article from Cybersecurity Dive, Microsoft and CrowdStrike have both pushed back on Delta Air Lines for blaming its IT operational issues on vendors. Microsoft cited Delta’s delayed modernization efforts as the root cause of the slow recovery after an IT outage. The software provider claimed that Delta declined offers of technical support to help restore systems and pointed out that the airline’s crew-tracking and scheduling system, which was run by IBM and other technology providers, was a major problem.

CrowdStrike, in a letter sent to Delta, forcefully denied the airline’s accusations of negligence and highlighted limitations of liability in Delta’s contract that limit damages in the millions. The public battle between Delta and its vendors arose after a flawed software update by CrowdStrike caused a major disruption, leading to over 5,000 canceled flights and costs estimated at over $500 million for Delta.

Both Microsoft and CrowdStrike have criticized Delta’s handling of the situation, with Microsoft directing Delta to preserve documents showing the role of non-Microsoft systems in the outage. The airline has stated its commitment to investing in IT infrastructure and declined to provide further comments on the matter.

Overall, this situation highlights the importance of vendor accountability and the potential legal implications of IT outages in large organizations like Delta Air Lines. It also underscores the complexities of modernizing IT infrastructure and the challenges of maintaining operational resilience in the face of technological disruptions.

Latest from Blog

EU push for unified incident report rules

TLDR: The Federation of European Risk Management Associations (FERMA) is urging the EU to harmonize cyber incident reporting requirements ahead of new legislation. Upcoming legislation such as the NIS2 Directive, DORA, and